Nestor Moran's questions

More than a question, it is a query, I am currently with an api serving data, and I have reached the following situation, I have a user preferences table, where the configuration options of each user are stored, with json, I do a get and it returns all the data from that table, and then I have to filter that data with the user id that is logged in, my point is, there is another way to do this, that is, with mysql in the query I put the user id and only It returned the data of that user, here it loads the data of all the users and then I have to filter. As I am inexperienced, I fear that if I have a record with more than a thousand data, and in the end I only need 1 of those data, I have to load all that, and in the end it would affect the performance of my page.

It's already too late to go back with the api, I would like to know if there is a solution, or maybe I'm exaggerating and this does not affect performance.

Thanks in advance.

I am currently working on a client with angularjs 1.5.8, and I have a service called AuthenticationService.

discovrApp.factory('AuthenticationService', function (
  $http,
  $rootScope,
  $localStorage,
  jwtHelper,
  apiURL){
  var service = {};

  var config = {headers:  {
      Authorization: '',
          'Content-Type': 'application/json'
      }
  };

  service.Login = Login;
  service.Logout = Logout;
  service.SignUp = SignUp;

  service.Profile = Profile;
  service.ChangePassword = ChangePassword;
  service.ResetPassword = ResetPassword;
  service.GetProfile = GetProfile;
  //service.SignUp = SignUp;
  //service.SignUp = SignUp;


  return service;

  function Login(username,password,callback) {
    $http.post(apiURL + 'api/rest/auth/login/', { username: username,   password: password })
      .success(function(response){
        //login successful if there's a token in the respose
        if(response.token){
          //decode token, to get the user id insert on payload
          var token = jwtHelper.decodeToken(response.token);
          var userProfile = 0;
          userProfile = GetProfile(token.user_id);
          console.log(userProfile);
          //store username and token in local storage to keep user logged in between paga refreshes
          $localStorage.currentUser = {id: token.user_id, username: username, token: response.token };
          //config.headers.Authorization = 'JWT ' + response.token;
          //add jwt token to auth header for all requests made by the $http services
         $http.defaults.headers.common.Authorization = 'JWT ' + response.token;
          //execuete callback with true to indicate successful login
          callback(true);
        }else{
          //execute callback with false to indicate failed login
          callback(false);
        }
      });
  }

  function Logout() {
    $http.post(apiURL + 'api/rest/auth/logout/')
      .success(function(response){
        //remove user from local storage and clear http auth header
        delete $localStorage.currentUser;
        localStorage.removeItem('user');
        config.headers.Authorization = '';
        $http.defaults.headers.common.Authorization = '';
      });

  }

  function SignUp(callback,username,password1,password2,email,more){
    $http.post(apiURL + 'api/rest/auth/registration/', { username: username, password1: password1, password2: password2, email: email})
      .success(function(response){
        //login successful if there's a token in the respose
        if(response.token){
         console.log(response.token);
         //store username and token in local storage to keep user logged in between paga refreshes
          $localStorage.currentUser = { username: username, token: response.token };
          //add jwt token to auth header for all requests made by the $http services
          $http.defaults.headers.common.Authorization = 'JWT ' + response.token;
          //execuete callback with true to indicate successful login
          callback(true);
        }else{
          //execute callback with false to indicate failed login
          callback(false);
        }
      });
  }

  function Profile(){
    $http.get(apiURL + 'api/user/' + $localStorage.currentUser.id + '/').
      then(function successCallback(response) {
          localStorage.setItem('user', JSON.stringify(response.data));
          console.log(response.data)
      }, function errorCallback(response) {
          console.log(response);
     });
  }

  function GetProfile(id){
    $http.get(apiURL + 'api/user/' + id + '/').
    then(function successCallback(response){
      $rootScope.userProfile = response.data.Kind;
      localStorage.setItem('profile', $rootScope.userProfile);
      //console.log(($rootScope.userProfile = response.data.Kind)); 
    });     
    return $rootScope.userProfile;
  }
});

I have the problem with the Profile() and GetProfile() functions, when I call them for the first time they always return or assign "undefined", and if I leave a console.log in the functions to print the result of the api, first it returns undefined, and if I call it again, it returns or assigns the value, the problem is the first time I always call it, it always returns undefined and the second time it doesn't, I would like to know if anyone has happened to it and knows the reason and how to fix this.

**NOTES: In the service that I create you will be able to notice several things, and that is that I have tried different ways such as saving the data returned by the get request in a local variable, and then printing this local variable, without a positive result at the first attempt. When refreshing the page, and trying again, it returns undefined at first and then returns it.

Thanks in advance, Regards.

I have already asked this question and it can be a song but I hope someone will help me, I am currently doing a project with django restframework, in which I am going to have two groups (Teachers, Students, School) and these already have their permissions assigned in django admin

How do I use group permissions in django rest-framework.

I leave part of my code Modelo.py

class MyUser(AbstractUser):
    P_LIST = ((1,'Tourist'),(2,'Enterprise'),(3,'Other'))
    Profile = models.IntegerField(choices = P_LIST, default = 1)

class BaseModel(models.Model):
    create = models.DateField(auto_now_add = True, null = False, blank = False)
    update = models.DateField(auto_now = True, null = False, blank = False)

    class Meta:
        abstract = True

class CatLanguage(BaseModel):
    idLanguage = models.AutoField(primary_key = True)
    Name = models.CharField(max_length = 50, null = False, blank = False)
    Acronym = models.CharField(max_length = 5, null = False)
    Note = models.CharField(max_length = 2500, null = True, blank = True)

    def __str__(self):
        return self.Name

class TblGallery(BaseModel):
    IdGallery = models.AutoField(primary_key = True)
    Location = models.CharField(max_length = 1500, null = False)

    def  __str__(self):
        return str(self.IdGallery)

Serializer and Viesets:

from django.contrib.auth.models import User
from django.contrib.auth.models import AbstractUser

from django.views import generic

from rest_framework.authentication import SessionAuthentication,    BasicAuthentication
from rest_framework import serializers, viewsets, permissions
from rest_framework_jwt.authentication import JSONWebTokenAuthentication

#Models Import
from Base.models import *
from Base.permissions import *

from rest_framework.authentication import SessionAuthentication 

class CsrfExemptSessionAuthentication(SessionAuthentication):

    def enforce_csrf(self, request):
        return  # To not perform the csrf check previously happening


"""
class MyUserSerializer(serializers.HyperlinkedModelSerializer):

    class Meta:
        model = MyUser
        fields = ('id','Profile','email', 'first_name', 'last_name', 'password', 'is_superuser')


class MyUserViewSet(viewsets.ModelViewSet):
    serializer_class = MyUserSerializer
    queryset = MyUser.objects.all()

    def get_serializer_class(self):
        return MyUserSerializer


""" 
#Serialiazers
class LanguageSerializer(serializers.HyperlinkedModelSerializer):
    class Meta:
        model = CatLanguage
        fields = ['idLanguage','Name','Acronym','Note','create','update']


class GallerySerializer(serializers.HyperlinkedModelSerializer):

    class Meta:
        model = TblGallery
        fields = ('IdGallery','Location','create','update')


class GalleryDetailSerializer(serializers.HyperlinkedModelSerializer):

    class Meta:
        model = TblGalleryDetail
        fields = ('IdGalleryDetail','IdGallery','IdLanguage','Name','Description')

#---------------    ViewSets      ----------------------------------------------
class LanguageViewSet(viewsets.ModelViewSet):
    #authentication_classes = [SessionAuthentication, BasicAuthentication, JSONWebTokenAuthentication]
    authentication_classes = (CsrfExemptSessionAuthentication, BasicAuthentication)
    permissions_classes = [UserPermission]
    queryset = CatLanguage.objects.all()
    serializers_class = LanguageSerializer

    def get_serializer_class(self):
        return LanguageSerializer

#---------------    
class GalleryViewSet(viewsets.ModelViewSet):
    serializers_class = GallerySerializer
    queryset = TblGallery.objects.all()

   def get_serializer_class(self):
        return GallerySerializer


class GalleryDetailViewSet(viewsets.ModelViewSet):
    serializers_class = GalleryDetailSerializer
    queryset = TblGalleryDetail.objects.all()

    def get_serializer_class(self):
        return GalleryDetailSerializer

I leave the Permissions.py there are class rods that and try, also none of them is to search for permissions and groups.

from rest_framework.exceptions import PermissionDenied, NotAuthenticated 
from rest_framework import permissions
from rest_framework.permissions import BasePermission
from django.contrib.auth.models import User

#---
from django.contrib.auth.decorators import user_passes_test

def group_required(*group_names):
    """Requires user membership in at least one of the groups passed in."""
    def in_groups(u):
        if u.is_authenticated():
            if bool(u.groups.filter(name__in=group_names)) | u.is_superuser:
                return True
        return False

    return user_passes_test(in_groups, login_url='403')



SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS','POST']

class Profile(BasePermission):

    def has_object_permission(self, request, view, obj):
        """
        Return True if the user is the owner of the ..
        """
        if request.method in SAFE_METHODS:
            return False
        elif request.method == 'PUT' or request.method =='POST':
            if request.user.Profile == 1:
                return True
            return False


class UserPermission(permissions.BasePermission):

    def has_permission(self, request, view):                                                        
        if view.action == 'list':                                                                   
            return request.user.is_authenticated() and request.user.is_admin                        
        elif view.action == 'create':                                                               
            return True                                                                             
        elif view.action in ['retrieve', 'update', 'partial_update', 'destroy']:                    
            return True                                                                             
        else:                                                                                       
            return False                                                                            

    def has_object_permission(self, request, view, obj):                                            
        if view.action == 'retrieve':                                                               
            return request.user.is_authenticated() and (obj == request.user or request.user.is_admin)    
        elif view.action in ['update', 'partial_update']:                                           
            return request.user.is_authenticated() and (obj == request.user or request.user.is_admin)    
        elif view.action == 'destroy':
            return request.user.is_authenticated() and request.user.Profile == 1                        
        else:
            return False

In the end, I repeat what I try to do is read the Group and individual permissions of a user and based on that allow him to read, create, update and delete records.

Thanks in advance

My problem or question is how to use the permissions assigned to users, whether they are group or individual permissions, so that when a user logs in using the Django Rest Framework, they only have access to the tables to which they have assigned permissions.

Currently if I log in I have access to all the tables, be it the admin user or any other. If you can give me an example, or show me a link where it is exemplified, it would be very helpful.

I leave the repository link on github https://github.com/Weed-Nim/BillAPI.git

For programming use the serializer and viewsets in each of the apps

Here I put pictures of the code:

PD: above is the repository, I only put a quick view of how I work it, although I repeat my doubt is how can I do it so that when a user logs in he only has access to the tables which he has permissions (individual or group) and it does not happen the image thing. Thanks in advance.